# Node-RED SSL using Letsencrypt & Certbot

**URL:** <https://discourse.nodered.org/t/node-red-ssl-using-letsencrypt-certbot/17606>\
**Category:** Share Your Projects\
**Tags:** security\
**Created:** [6 November 2019 20:22 UTC](https://discourse.nodered.org/t/node-red-ssl-using-letsencrypt-certbot/17606 "2019-11-06T20:22:22Z")\
**Posts on this page:** 17\
**Page:** 3

<div class="post-metadata">

**Author:** ![BartButenaers](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/bartbutenaers/32/10476_2.png) [@BartButenaers](https://discourse.nodered.org/u/BartButenaers)\
**Post date:** [7 December 2020 23:24 UTC](https://discourse.nodered.org/t/node-red-ssl-using-letsencrypt-certbot/17606/41 "2020-12-07T23:24:26Z")

</div>

Hey guys,  
Also don't forget that we spend quite some time at the time being on this [pull-request](https://github.com/node-red/node-red/pull/2551), to have automatic certificate [renewal](https://nodered.org/docs/user-guide/runtime/securing-node-red#refreshing-https-certificates) into Node-RED 1.1.0 and above... Then Node-RED will detect and load the renewed certificates automatically, without having to restart Node-RED...  
Bart

---

<div class="post-metadata">

**Author:** ![catonia](https://avatars.discourse-cdn.com/v4/letter/c/b5e925/32.png) [@catonia](https://discourse.nodered.org/u/catonia)\
**Post date:** [8 December 2020 10:19 UTC](https://discourse.nodered.org/t/node-red-ssl-using-letsencrypt-certbot/17606/43 "2020-12-08T10:19:21Z")

</div>

Hi,  
Thanks very much for your reply.  
Anyway, as a beginner, my question was mainly related to understanding how the renewal\_succes" scripts gets called (when certs are actually renewed).  
This is a solution to update certs and I really appreciate your help. I'll keep it in mind in case of troubles (and probably for future projects).  
Thanks!

---

<div class="post-metadata">

**Author:** ![catonia](https://avatars.discourse-cdn.com/v4/letter/c/b5e925/32.png) [@catonia](https://discourse.nodered.org/u/catonia)\
**Post date:** [8 December 2020 10:22 UTC](https://discourse.nodered.org/t/node-red-ssl-using-letsencrypt-certbot/17606/44 "2020-12-08T10:22:59Z")

</div>

Hi Paul,  
thanks for your response.  
got it. I was missing that the script is automatically called by certbot!  
Thanks again for sharing this useful post.

---

<div class="post-metadata">

**Author:** ![Paul-Reed](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/paul-reed/32/66906_2.png) [@Paul-Reed](https://discourse.nodered.org/u/Paul-Reed)\
**Post date:** [8 December 2020 22:16 UTC](https://discourse.nodered.org/t/node-red-ssl-using-letsencrypt-certbot/17606/45 "2020-12-08T22:16:28Z")

</div>

As @BartButenaers mentions above, don't forget about the `httpsRefreshInterval` which has been introduced into node-RED since v1.1.0.

A bit of background....

By default, node-RED reads in the SSL certificates **only** when node-RED starts, so even though you have renewed your certificates with certbot. Node-RED will not load them until it has been restarted.

To deal with this, if you use `httpsRefreshInterval` in your `settings.js` file, then the certificates will be reloaded into the running system automatically, avoiding the need to restart the system.

See [Securing Node-RED : Node-RED](https://nodered.org/docs/user-guide/runtime/securing-node-red#refreshing-https-certificates)

---

<div class="post-metadata">

**Author:** ![Paul-Reed](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/paul-reed/32/66906_2.png) [@Paul-Reed](https://discourse.nodered.org/u/Paul-Reed)\
**Post date:** [9 December 2020 18:48 UTC](https://discourse.nodered.org/t/node-red-ssl-using-letsencrypt-certbot/17606/46 "2020-12-09T18:48:32Z")

</div>

Split this topic on 9 December 2020 18:48 UTC

2 posts were split to a new topic: [Unable to update node.js](https://discourse.nodered.org/t/unable-to-update-node-js/37264)

---

<div class="post-metadata">

**Author:** ![fmarzocca](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/fmarzocca/32/35901_2.png) [@fmarzocca](https://discourse.nodered.org/u/fmarzocca)\
**Post date:** [20 April 2021 09:24 UTC](https://discourse.nodered.org/t/node-red-ssl-using-letsencrypt-certbot/17606/48 "2021-04-20T09:24:44Z")

</div>

@Paul-Reed , the docs say that, if you use `httpsRefreshInterval`, "_..the `https` setting must be a Function that can be called to get the updated certificates._"  
I have no idea about how this function must be set...

---

<div class="post-metadata">

**Author:** ![Paul-Reed](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/paul-reed/32/66906_2.png) [@Paul-Reed](https://discourse.nodered.org/u/Paul-Reed)\
**Post date:** [20 April 2021 10:52 UTC](https://discourse.nodered.org/t/node-red-ssl-using-letsencrypt-certbot/17606/49 "2021-04-20T10:52:15Z")

</div>

> [@fmarzocca](#):
>
> I have no idea about how this function must be set..

Take a look at the [https section in settings.js](https://github.com/node-red/node-red/blob/master/packages/node_modules/node-red/settings.js#L140-L158) and it gives you 2 options. Choose the `https function` option.

---

<div class="post-metadata">

**Author:** ![fmarzocca](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/fmarzocca/32/35901_2.png) [@fmarzocca](https://discourse.nodered.org/u/fmarzocca)\
**Post date:** [20 April 2021 11:41 UTC](https://discourse.nodered.org/t/node-red-ssl-using-letsencrypt-certbot/17606/50 "2021-04-20T11:41:50Z")

</div>

> [@Paul-Reed](#):
>
> Choose the `https function` option.

Yes, but I can't image what to code into the function in order to get the updated certificates...

---

<div class="post-metadata">

**Author:** ![BartButenaers](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/bartbutenaers/32/10476_2.png) [@BartButenaers](https://discourse.nodered.org/u/BartButenaers)\
**Post date:** [20 April 2021 14:05 UTC](https://discourse.nodered.org/t/node-red-ssl-using-letsencrypt-certbot/17606/51 "2021-04-20T14:05:36Z")

</div>

> [@fmarzocca](#):
>
> what to code into the function in order to get the updated certificates...

Hi Fabio,  
In my setup at home I simply tell Node-RED to reload (every 6 hours) the key-pair (certificate and corresponding private key) from my Node-RED keystores:

```auto
    https: function() {
        return {
            key: require("fs").readFileSync('/home/pi/.node-red/privkey.pem'),
            cert: require("fs").readFileSync('/home/pi/.node-red/cert.pem')
        }
    },
    httpsRefreshInterval : 6,

```

That is all...  
But you can add any kind of source code, as long as you return a key-pair ...

Of course you need to make sure that the certificate in your keystore is up-to-date.  
There are multiple ways to accomplish that...  
I refresh my LetsEncrypt certificates automatically with my [node-red-contrib-letsencrypt](https://github.com/bartbutenaers/node-red-contrib-letsencrypt) node.  
This node is not published on NPM, because I didn't had time yet to test all supported DNS providers.  
But for DuckDNS it works fine...  
Bart

---

<div class="post-metadata">

**Author:** ![fmarzocca](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/fmarzocca/32/35901_2.png) [@fmarzocca](https://discourse.nodered.org/u/fmarzocca)\
**Post date:** [20 April 2021 14:19 UTC](https://discourse.nodered.org/t/node-red-ssl-using-letsencrypt-certbot/17606/52 "2021-04-20T14:19:16Z")

</div>

> [@BartButenaers](#):
>
> Of course you need to make sure that the certificate in your keystore is up-to-date.

I could use your script " **renewal\_success**" in order to do that (without restarting node). In a cronjob every 6 hours.  
What do you think?

---

<div class="post-metadata">

**Author:** ![BartButenaers](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/bartbutenaers/32/10476_2.png) [@BartButenaers](https://discourse.nodered.org/u/BartButenaers)\
**Post date:** [20 April 2021 14:30 UTC](https://discourse.nodered.org/t/node-red-ssl-using-letsencrypt-certbot/17606/53 "2021-04-20T14:30:08Z")

</div>

> [@fmarzocca](#):
>
> your script " **renewal\_success**"

That script is from @Paul-Reed. You have to install Certbot manually, and call Certbot via that script periodically. Or you can use my node, which doesn't require Certbot.  
It is competely up to you how you want to get a new certificate from LetsEncrypt. I personally like to have everything integrated into Node-RED without having to install third-party tools. That is why I developed that Node, after Paul wrote above tutorial...

---

<div class="post-metadata">

**Author:** ![fmarzocca](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/fmarzocca/32/35901_2.png) [@fmarzocca](https://discourse.nodered.org/u/fmarzocca)\
**Post date:** [20 April 2021 14:37 UTC](https://discourse.nodered.org/t/node-red-ssl-using-letsencrypt-certbot/17606/54 "2021-04-20T14:37:02Z")

</div>

In my other installation (on a webserver) I don't need to call certbot as the installation has provided for that.

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [20 April 2021 18:52 UTC](https://discourse.nodered.org/t/node-red-ssl-using-letsencrypt-certbot/17606/56 "2021-04-20T18:52:26Z")

</div>

> [@BartButenaers](#):
>
> I refresh my LetsEncrypt certificates automatically with my [node-red-contrib-letsencrypt](https://github.com/bartbutenaers/node-red-contrib-letsencrypt) node.

And I do it using the `acme.sh` shell script and CRON. Partly because I update two domains and they both have complex multi-wildcard settings. Oh, and because that node didn't exist when I started 😀

---

<div class="post-metadata">

**Author:** ![fmarzocca](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/fmarzocca/32/35901_2.png) [@fmarzocca](https://discourse.nodered.org/u/fmarzocca)\
**Post date:** [9 May 2021 13:52 UTC](https://discourse.nodered.org/t/node-red-ssl-using-letsencrypt-certbot/17606/57 "2021-05-09T13:52:01Z")

</div>

Hi @Paul-Reed, is this still valid? Do I have to replace `cert.pem` with `fullchain.pem`?

---

<div class="post-metadata">

**Author:** ![Paul-Reed](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/paul-reed/32/66906_2.png) [@Paul-Reed](https://discourse.nodered.org/u/Paul-Reed)\
**Post date:** [9 May 2021 14:48 UTC](https://discourse.nodered.org/t/node-red-ssl-using-letsencrypt-certbot/17606/58 "2021-05-09T14:48:52Z")

</div>

> [@fmarzocca](#):
>
> is this still valid?

Yes

> [@fmarzocca](#):
>
> Do I have to replace `cert.pem` with `fullchain.pem` ?

Just follow the guide, it explains what certificates to use.  
The `fullchain.pem` contains the `cert.pem` and the `chain.pem` which is needed for correct validation. See [Letsencrypt chain.pem or trusted root list cert? - #10 by JuergenAuer - Help - Let's Encrypt Community Support](https://community.letsencrypt.org/t/letsencrypt-chain-pem-or-trusted-root-list-cert/105921/10)

---

<div class="post-metadata">

**Author:** ![Paul-Reed](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/paul-reed/32/66906_2.png) [@Paul-Reed](https://discourse.nodered.org/u/Paul-Reed)\
**Post date:** [10 May 2021 07:58 UTC](https://discourse.nodered.org/t/node-red-ssl-using-letsencrypt-certbot/17606/59 "2021-05-10T07:58:01Z")

</div>

Split this topic on 10 May 2021 07:58 UTC

A post was split to a new topic: [Enable https, but still access with local IP](https://discourse.nodered.org/t/enable-https-but-still-access-with-local-ip/45417)

---

<div class="post-metadata">

**Author:** ![Paul-Reed](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/paul-reed/32/66906_2.png) [@Paul-Reed](https://discourse.nodered.org/u/Paul-Reed)\
**Post date:** [13 May 2021 12:35 UTC](https://discourse.nodered.org/t/node-red-ssl-using-letsencrypt-certbot/17606/60 "2021-05-13T12:35:05Z")

</div>

Closed on 13 May 2021 12:35 UTC



[Previous page](https://discourse.nodered.org/t/node-red-ssl-using-letsencrypt-certbot/17606.md?page=2)